<!--#include virtual="includes/_header.htm" -->

<body class="page-cve-list ">
    <!--#include virtual="includes/_top.htm" -->
    <div class="content">
        <!--#include virtual="includes/_nav.htm" -->
        <div class="right">

            <h1>Apache Kafka Security Vulnerabilities</h1>

            This page lists all security vulnerabilities fixed in released versions of Apache Kafka.

            <h2 id="CVE-2022-34917"><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-34917">CVE-2022-34917</a> Unauthenticated clients may cause OutOfMemoryError on brokers </h2>

            <p>This CVE identified a flaw where it allows the malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and
                causing denial of service.</p>

            <table class="data-table">
                <tbody>
                    <tr>
                        <td>Versions affected</td>
                        <td>2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.2</td>
                    </tr>
                    <tr>
                        <td>Fixed versions</td>
                        <td>2.8.2, 3.0.2, 3.1.2, 3.2.3</td>
                    </tr>
                    <tr>
                        <td>Impact</td>
                        <td>Example scenarios in which attacker can cause OutOfMemoryError on brokers<br>
                            - Kafka cluster without authentication: Any clients able to establish
                            a network connection to a broker can trigger the issue.<br>
                            - Kafka cluster with SASL authentication: Any clients able to
                            establish a network connection to a broker, without the need for valid
                            SASL credentials, can trigger the issue.<br>
                            - Kafka cluster with TLS authentication: Only clients able to
                            successfully authenticate via TLS can trigger the issue.<br>
                        </td>
                    </tr>
                    <tr>
                        <td>Issue announced</td>
                        <td>19 Sep 2022</td>
                    </tr>
                </tbody>
            </table>

            <!--#include virtual="includes/_footer.htm" -->
